Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| minio | minio | affected |
|
No data.
No data available yet.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-2pxw-r47w-4p8c | Privilege Escalation on Linux/MacOS |
Wed, 25 Feb 2026 17:45:00 +0100
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`. | Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`. |
Wed, 22 Oct 2025 02:15:00 +0200
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Tue, 21 Oct 2025 22:30:00 +0200
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Tue, 21 Oct 2025 21:30:00 +0200
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Tue, 28 Jan 2025 23:15:00 +0100
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
kev
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2025-10-21T23:15:22.302Z
Reserved: 2023-03-15T15:59:10.053Z
Link: CVE-2023-28434
Vulnrichment
Updated: 2024-08-02T12:38:25.275Z
NVD
Status : Analyzed
Published: 2023-03-22T21:15:18.427
Modified: 2026-06-17T05:47:43.610
Link: CVE-2023-28434
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-269
Improper Privilege Management
- NVD-CWE-noinfo